Parser ini mengekstrak data peristiwa keamanan dari log JSON ServiceNow, memetakan kolom yang relevan ke UDM. Log ini menangani berbagai jenis peristiwa seperti login dan perubahan izin, mengisi informasi pengguna utama/target, alamat IP, dan metadata seperti detail vendor dan produk.
Sebelum memulai
Pastikan Anda memenuhi prasyarat berikut:
Instance Google SecOps.
Akses istimewa ke ServiceNow Security.
Menyiapkan feed
Untuk mengonfigurasi feed, ikuti langkah-langkah berikut:
Buka Setelan SIEM>Feed.
Klik Tambahkan Feed Baru.
Di halaman berikutnya, klik Konfigurasi satu feed.
Di kolom Nama feed, masukkan nama untuk feed; misalnya, Log Keamanan ServiceNow.
Pilih Webhook sebagai Jenis sumber.
Pilih ServiceNow Security sebagai Jenis log.
Klik Berikutnya.
Opsional: Tentukan nilai untuk parameter input berikut:
Pemisah pemisahan: pemisah yang digunakan untuk memisahkan baris log, seperti \n.
Klik Berikutnya.
Tinjau konfigurasi feed di layar Selesaikan, lalu klik Kirim.
Klik Buat Kunci Rahasia untuk membuat kunci rahasia guna mengautentikasi feed ini.
Salin dan simpan kunci rahasia. Anda tidak dapat melihat kunci rahasia ini lagi. Jika perlu, Anda dapat membuat ulang kunci rahasia baru, tetapi tindakan ini akan membuat kunci rahasia sebelumnya tidak berlaku.
Dari tab Detail, salin URL endpoint feed dari kolom Informasi Endpoint. Anda perlu menentukan URL endpoint ini di aplikasi klien Anda.
Rekomendasi: Tentukan kunci API sebagai header, bukan menentukannya di URL.
Jika klien webhook Anda tidak mendukung header kustom, Anda dapat menentukan kunci API dan kunci rahasia menggunakan parameter kueri dalam format berikut:
ENDPOINT_URL?key=API_KEY&secret=SECRET
Ganti kode berikut:
ENDPOINT_URL: URL endpoint feed.
API_KEY: kunci API untuk mengautentikasi ke Google SecOps.
SECRET: kunci rahasia yang Anda buat untuk mengautentikasi feed.
Mengonfigurasi Webhook di ServiceNow
Login ke ServiceNow Security dengan akun istimewa.
Buka Konfigurasi>Monitoring>Koneksi.
Klik
add
.
Pilih Webhook.
Tentukan nilai untuk parameter berikut:
Nama: Berikan nama deskriptif untuk webhook (misalnya, Google SecOps).
URL: Masukkan ENDPOINT_URL Google SecOps dengan API_KEY dan SECRET.
Klik Simpan untuk menyelesaikan konfigurasi webhook.
Pemetaan UDM
Kolom log
Pemetaan UDM
Logika
created_by
target.user.userid
Dipetakan ke target.user.userid jika snc_user kosong.
event
metadata.product_event_type
Dipetakan langsung dari kolom log mentah "event".
event_created
metadata.event_timestamp.seconds
Dikonversi menjadi detik dari kolom log mentah "event_created" menggunakan filter date.
ip_address
principal.ip
Dipetakan langsung dari kolom log mentah "ip_address" jika tidak kosong.
snc_user
target.user.userid
Dipetakan langsung dari kolom log mentah "snc_user" jika tidak kosong.
pengguna
principal.user.userid
Dipetakan langsung dari kolom log mentah "user" jika tidak kosong atau "null".
extensions.auth.type
Tetapkan ke "MACHINE" jika kolom event adalah "Failed Login", "SNC Login", "Admin Login", atau "Impersonation".
metadata.event_type
Setel ke "USER_LOGIN" jika kolom event adalah "Failed Login", "SNC Login", "Admin Login", atau "Impersonation". Tetapkan ke "USER_CHANGE_PERMISSIONS" jika kolom event adalah "Peningkatan Keamanan".
metadata.log_type
Dikodekan secara permanen ke "SERVICENOW_SECURITY".
metadata.product_name
Dikodekan secara permanen ke "SERVICENOW_SECURITY".
metadata.vendor_name
Dikodekan secara permanen ke "SERVICENOW".
principal.user.userid
Ditetapkan ke "UNKNOWN" jika kolom user kosong atau "null".
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-04 UTC."],[[["\u003cp\u003eThis guide outlines how to collect security event data from ServiceNow JSON logs and ingest them into Google SecOps using a webhook feed.\u003c/p\u003e\n"],["\u003cp\u003eThe process involves setting up a feed in Google SecOps, generating a secret API key, and configuring the ServiceNow webhook to send logs to the specified Google SecOps endpoint URL.\u003c/p\u003e\n"],["\u003cp\u003eSecurity event types such as logins and permission changes are handled, and data fields from ServiceNow logs are mapped to the Unified Data Model (UDM) within Google SecOps.\u003c/p\u003e\n"],["\u003cp\u003eAuthentication for the webhook feed is managed using an API key and secret key, which can be specified in the request header or as query parameters.\u003c/p\u003e\n"],["\u003cp\u003eSpecific UDM mapping is provided, outlining how fields like user IDs, event timestamps, IP addresses, and event types are transferred from ServiceNow to their corresponding fields in Google Security Operations.\u003c/p\u003e\n"]]],[],null,["# Collect ServiceNow Security logs\n================================\n\nSupported in: \nGoogle secops [SIEM](/chronicle/docs/secops/google-secops-siem-toc)\n| **Note:** This feature is covered by [Pre-GA Offerings Terms](https://chronicle.security/legal/service-terms/) of the Google Security Operations Service Specific Terms. Pre-GA features might have limited support, and changes to pre-GA features might not be compatible with other pre-GA versions. For more information, see the [Google SecOps Technical Support Service guidelines](https://chronicle.security/legal/technical-support-services-guidelines/) and the [Google SecOps Service Specific Terms](https://chronicle.security/legal/service-terms/).\n\nOverview\n--------\n\nThis parser extracts security event data from ServiceNow JSON logs, mapping relevant fields to the UDM. It handles various event types like logins and permission changes, populating principal/target user information, IP addresses, and metadata like vendor and product details.\n\nBefore you begin\n----------------\n\nEnsure that you have the following prerequisites:\n\n- Google SecOps instance.\n- Privileged access to ServiceNow Security.\n\nSet up feeds\n------------\n\nTo configure a feed, follow these steps:\n\n1. Go to **SIEM Settings** \\\u003e **Feeds**.\n2. Click **Add New Feed**.\n3. On the next page, click **Configure a single feed**.\n4. In the **Feed name** field, enter a name for the feed; for example, **ServiceNow Security Logs**.\n5. Select **Webhook** as the **Source type**.\n6. Select **ServiceNow Security** as the **Log type**.\n7. Click **Next**.\n8. Optional: Specify values for the following input parameters:\n - **Split delimiter** : the delimiter that is used to separate log lines, such as `\\n`.\n9. Click **Next**.\n10. Review the feed configuration in the **Finalize** screen, and then click **Submit**.\n11. Click **Generate Secret Key** to generate a secret key to authenticate this feed.\n12. Copy and store the secret key. You cannot view this secret key again. If needed, you can regenerate a new secret key, but this action makes the previous secret key obsolete.\n13. From the **Details** tab, copy the feed endpoint URL from the **Endpoint Information** field. You need to specify this endpoint URL in your client application.\n14. Click **Done**.\n\nCreate an API key for the webhook feed\n--------------------------------------\n\n1. Go to **Google Cloud console \\\u003e Credentials**.\n\n [Go to Credentials](https://console.cloud.google.com/apis/credentials)\n2. Click **Create credentials** , and then select **API key**.\n\n3. Restrict the API key access to the **Google Security Operations API**.\n\nSpecify the endpoint URL\n------------------------\n\n1. In your client application, specify the HTTPS endpoint URL provided in the webhook feed.\n2. Enable authentication by specifying the API key and secret key as part of the custom header in the following format:\n\n X-goog-api-key = \u003cvar class=\"readonly\" translate=\"no\"\u003eAPI_KEY\u003c/var\u003e\n X-Webhook-Access-Key = \u003cvar class=\"readonly\" translate=\"no\"\u003eSECRET\u003c/var\u003e\n\n **Recommendation**: Specify the API key as a header instead of specifying it in the URL.\n3. If your webhook client doesn't support custom headers, you can specify the API key and secret key using query parameters in the following format:\n\n \u003cvar translate=\"no\"\u003eENDPOINT_URL\u003c/var\u003e?key=\u003cvar translate=\"no\"\u003eAPI_KEY\u003c/var\u003e&secret=\u003cvar translate=\"no\"\u003eSECRET\u003c/var\u003e\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eENDPOINT_URL\u003c/var\u003e: the feed endpoint URL.\n - \u003cvar translate=\"no\"\u003eAPI_KEY\u003c/var\u003e: the API key to authenticate to Google SecOps.\n - \u003cvar translate=\"no\"\u003eSECRET\u003c/var\u003e: the secret key that you generated to authenticate the feed.\n\nConfigure Webhook in ServiceNow\n-------------------------------\n\n1. Sign in to ServiceNow Security with privileged account.\n2. Go to **Configuration** \\\u003e **Monitoring** \\\u003e **Connections**.\n3. Click add .\n4. Select **Webhook**.\n5. Specify values for the following parameters:\n - **Name** : Provide a descriptive name for the webhook (for example, **Google SecOps**).\n - **URL** : Enter the Google SecOps **ENDPOINT_URL** with **API_KEY** and **SECRET**.\n6. Click **Save** to complete the webhook configuration.\n\nUDM Mapping\n-----------\n\n**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)"]]
